Lawyerd for Law Firms is security software for the attacks that cost firms millions in 2026: a call from fake “IT”, a remote session, files copied out within the hour, then extortion. It verifies every IT contact, trains staff on the real playbook, raises alerts in seconds and keeps the record your insurer and clients ask for.
See the check in actionSaaS · Works in Microsoft Teams and by phone · No access to client files or matter data · Early access for a limited number of firms
On 7 October 2026, DataBreaches.net published an analysis of leaked internal chats attributed to Silent Ransom Group, a data-extortion crew also tracked as Luna Moth, Chatty Spider and UNC3753. The chats’ deal board records about $207 million paid by 27 firms between April and September 2026, with a median payment of $6 million. The firms have not confirmed the figures and the group denies the leak, but nine of the 27 had reported breaches matching the dates.
None of it needed malware. The FBI’s FLASH alert of 26 May 2026 describes the playbook: an employee gets a call from someone posing as the firm’s IT department, is talked into a remote-support session with a legitimate tool, and files go to Google Drive, OneDrive or an external server. When the call fails, someone turns up at the office “from IT” with a USB drive. Mandiant’s June 2026 report on the same campaign saw data searched, staged and stolen in under an hour, and extortion emails within 30 minutes, with threats to call the firm’s clients.
Antivirus does not flag any of it: every tool involved is legitimate. The control the FBI and Mandiant point to is a procedure. Staff must know “when and how IT support will communicate and authenticate themselves to employees”, and visiting technicians must be checked against scheduled work, out of band. Lawyerd for Law Firms turns that procedure into software your staff can use on a live call.
IT, in-house or at your IT provider, announces each contact in Lawyerd first. The employee sees a Teams card with the technician’s name, the ticket and a code. No code, no screen share.
A suspicious call, email or visitor is reported from Teams or the phone in one tap. IT gets the alert in seconds, with the number, the time and what was asked.
A number or address reported at one firm is flagged at every firm on Lawyerd, so a caller who tried the firm next door is already known at yours.
Simulated fake-IT calls and invoice emails built on the scenarios the FBI and Mandiant describe, run with your permission, plus five-minute refreshers for anyone who falls for one.
An IT-contact policy built on the FBI’s recommendations, and a monthly record of verified contacts, reports and drills for cyber-insurance renewals and client security questionnaires.
A first-hour plan for your team, monitoring of leak sites and search results for your firm and your clients, and removal of open-web copies together with your breach counsel.
It is not antivirus, MFA, endpoint detection or your incident-response retainer, and it does not replace them. It covers what they leave open: people, at the moment an employee has to decide whether the voice on the phone is really IT.
It never needs your documents. The platform uses your staff directory and your IT team’s accounts, with no access to client files, matter data, email content or your document management system.
Early access is open to a limited number of firms.
A 20-minute call with your IT lead or provider and a one-page gap list against the FBI’s May 2026 recommendations. Nothing to install.
The platform for the whole firm or one office, set up with your IT team or your IT provider. Early-access pricing agreed per firm.
Managed service providers are the IT desk attackers impersonate. One console for all your law-firm clients, so your technicians can prove who they are on every call.
Security software (SaaS) for law firms and their IT providers. It protects against the social-engineering attacks antivirus does not see: fake IT support calls, visits by fake technicians and data extortion. It verifies every IT contact, runs staff drills, raises alerts in seconds and keeps a record for insurers and clients. It is in early access for a limited number of firms.
A data-extortion group, also tracked as Luna Moth, Chatty Spider and UNC3753, active since at least 2022 and lately focused on US law firms. It does not encrypt anything. It steals files through phone-based social engineering, then demands payment to keep them from being published or sent to the firm’s clients.
The caller claims to be from your IT department or IT provider, often after an email about an invoice that contains no link or attachment. They ask the employee to start a remote-support session with a legitimate tool such as Zoho Assist, Quick Assist, AnyDesk or a Teams screen share, then copy files to cloud storage. When the call fails, the FBI reports that the group has sent people to offices posing as IT staff with USB drives.
Start with the FBI’s FLASH alert of 26 May 2026: verify the credentials of everyone who enters company spaces, including copies of visitors’ ID; limit access to sensitive data from home and public networks; tell staff when and how IT support will communicate and authenticate itself; train staff to spot and report phishing; keep regular backups; require phishing-resistant multi-factor authentication; block port 22 where possible; and disable remote access and external drives on computers with sensitive data. Mandiant adds: block unapproved remote-support tools, restrict USB storage, alert on mass downloads from document systems, and check visiting technicians against scheduled work orders.
Agree the rule before the call, not during it. With Lawyerd for Law Firms, the technician opens each contact in the console and the employee receives a Teams message or a text with the technician’s name, the ticket and a code. If the caller cannot give the code, the employee hangs up and reports the call. Without a tool, the minimum is a rule that staff never accept a remote session from an incoming call and ring IT back on the number they already know.
Usually not on its own. The FBI notes that recent attacks left few artifacts and used legitimate remote-access tools that antivirus is unlikely to flag. Blocking unapproved remote tools and USB storage helps, but the deciding moment is still the employee’s choice on the phone.
Partly. Drills and five-minute refreshers are built in, but training alone does not help an employee in the middle of a live call. Lawyerd for Law Firms gives staff a check to run in that moment and a button to report, and gives IT the alert.
Yes, and it is the most common case: the attackers pose as your provider. The provider’s technicians open contacts from the same console, so your staff check them the same way. IT providers can run it for every law firm they support.
No. The platform uses your staff directory and your IT team’s accounts. It never touches client files, matter data, email content or your document management system.
Bring in your breach counsel first. Where files appear on the open web, we find the copies, send notices to hosts, platforms and search engines, and assemble the evidence for a court order where your counsel seeks one, then serve it where the files are. Material that sits only on Tor sites cannot be removed by notice, and we say so up front.
It gives you evidence for both. Insurance broker Howden’s bulletin on the FBI alert lists formal IT verification and authentication procedures among its recommendations for law firms. The monthly record shows every verified IT contact, every report and every drill, which you can cite in renewal forms and client questionnaires.
Early-access pricing is agreed per firm and depends on the number of staff and whether IT is in-house or outsourced. The readiness check is free. IT providers get partner terms for all the firms they support.
Two minutes. A person reads every request and replies within one business day.